Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Before you close this out to repetition, I have been researching all of the proposed solutions to this bug and so far I have been unable to keep a FTP user jailed to their website directory. While I am not a ubuntu server expert, I wanted to reach out to the community to see if anyone has found a solution that both fixes this bug and keeps the user jailed to their directory.

My vsftpd settings that I changed:

listen_port=9000
Set: anonymous_enable=NO 
Uncomment: local_enable=YES 
Uncomment: write_enable=YES 
Uncomment: local_umask=022 
Set: connect_from_port_20=NO 
Uncomment: idle_session_timeout=600
Uncomment: data_connection_timeout=120 
Comment out: #ftpd_banner=Welcome to blah FTP service. [should be on line 104]
Added: banner_file=/etc/issue.net 
Uncomment: chroot_local_user=YES
Uncomment: chroot_local_user=YES 
Uncomment: chroot_list_enable=YES 
Uncomment : chroot_list_file=/etc/vsftpd.chroot_list

At the end of the file I added:

# Show hidden files and the "." and ".." folders.
# Useful to not write over hidden files:
force_dot_files=YES

# Hide the info about the owner (user and group) of the files.
hide_ids=YES

# Connection limit for each IP:
max_per_ip=10

# Maximum number of clients:
max_clients=5

# FTP Passive Settings
pasv_enable=YES
#If your listen_port is 9000 set this range to 7500 and 8500
pasv_min_port=[port range min]
pasv_max_port=[port range max]

The user in question mybloguser is jailed to her website directory under /srv/www/myblog and this user is not part of the nano /etc/vsftpd.chroot_list file. The user’s home directory is also /srv/www/myblog which used to work in the past.

I tried the allow_writeable_chroot=YES solution which did not work, and actually broke vsftpd completely.

I have tried:

http://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot

VSFTPd stopped working after update

http://programster.blogspot.com/2012/12/ubuntu-1204-setting-up-ftp-server-with.html

http://imbuzu.wordpress.com/2012/05/07/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot-on-vsftpd/

How can we both fix this error and keep the user jailed to their home directory?

share|improve this question

6 Answers 6

up vote 7 down vote accepted

After further review of this post, in the comments a package was posted that fixed my issue. You can search for it by either my name or "Marks" Documentation: http://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/. Here are my details of how I fixed this further.

USERS ARE STILL JAILED TO THEIR HOME DIRECTORIES!!!

# ------------------------------------------------------------------------------
# SETUP FTP USERS --------------------------------------------------------------
# ------------------------------------------------------------------------------

# create the ftp users and lock them to the website directories
useradd -d /srv/www/[website/appname] -m [ftp user name]

# set the ftp account passwords
passwd [ftp user name]

# add the ftp users to the www-data user/group
adduser [ftp user name] www-data

# BUG FIX: 500 OOPS: vsftpd: refusing to run with writable root inside chroot()
sudo add-apt-repository ppa:thefrontiergroup/vsftpd
sudo apt-get update
sudo apt-get install vsftpd

# Edit the vsftpd.conf and append this setting to the end of the file to keep users' jailed!
nano /etc/vsftpd.conf

# add all of the text between the starting [[ and ending ]]
# [[

# Keep non-chroot listed users jailed
allow_writeable_chroot=YES

# ]]

# restart the service for changes to take effect
sudo service vsftpd restart

#test ftp via secondary terminal window:
ftp [ftp user name]@[server ipaddress] [ftp port]
share|improve this answer
4  
Please Note: Chris's solution will add a third-party package server to your repository list! Why install a secure, chrooted FTP server when you blindly accept foreign software packages to be installed on your system. (Chris: I don't think that you will take advantage, but using this solution IMHO is bad sysadmining) –  reto May 21 '13 at 11:38
1  
do you have a better approach to solving this dilemma @reto? It has been a small mess to solve. THank you for your help. –  chrishough Jun 6 '13 at 7:00
    
if there's an updated package from the distribution I would try to use that. Most distributions provide backports for older releases. If thats not possible I'd get the source from the original developer and build it myself. If there's a patch floating around I might apply it (usually they are small and can manually be checked). –  reto Jun 6 '13 at 8:48
    
This Thread has 12'000 views, lets assume that 5% use your solution and added your repo. You could easily add a new version of a core package with a backdoor integrated. Within a week you could have access to 600 systems out there. I don't think that you would do that, but adding third-party repo is just not very safe. –  reto Jun 6 '13 at 8:51
    
(i've just see that this probably is not your repository server, so please understand the 'you' as 'the owner of the repository') –  reto Jun 6 '13 at 9:44

According to previous answer "The REAL solution of this problem: the home folder of the user should not be writable only read.". General think is right but with wrong realization.

Below i'll try to give simple example:

For start we need to build topology of user directory:

 /home (ro)   
   |-someuser (rw,700)
         |-ftp_upload (ro,555)  - ch_rooting here, required ro by vsftpd :(
           |-temp (rw,755)
           |-in_box (rw,755)
           |-out_box (rw,755)

vsftpd.conf cut:

#enable chrooting
chroot_local_user=YES

#chroot all users except listened inside chroot_list
chroot_list_enable=YES

#exception list, ideally should be blank ;) 
chroot_list_file=/etc/vsftpd/chroot_list

#map ftp root dir to specifiec dir 
local_root=/home/someuser/ftp

This configuration works great with single-user configuration, for multi-user should be used additionally "user_config_dir" directive.

**UPDATE 20/09

------**

Here is tricky workaround, not best idea to use, but.... If u need writable ftp root folder, just insert permission change commands in pre-start and post-start commands.

1) pre-start - change permissions to read-only, which server require (:

2) start server

3) post-start - change permission to read-write, or which u need.

share|improve this answer
    
I tried many variations but could not make it work for a WP server. Is this working for you on a WP configuration? –  chrishough Sep 9 '13 at 18:42
    
look to update section, mauby this variant can help u, it's not completely safe to do so, but if no other possibilities... –  Reishin Sep 20 '13 at 16:10

The real solution of this problem: the home folder of the user should not be writable only readable.

So, if user site is in the folder is cat/example.com/http/, folder cat must have chmod 555 and all will be OK.

share|improve this answer
4  
That makes no sense. The user's directory should not be writeable??? –  Kevin Bowen Jul 5 '13 at 22:53
    
How exactly is the user supposed to UPLOAD files if they can't write?! –  Cerin Aug 5 '13 at 20:03
    
It works well for an anonymous ftp without upload rights, thanks! –  palacsint Mar 29 at 11:45
    
right! now it's ok –  user1406691 May 28 at 18:18
    
This works perfectly! Just create an home for the user with chmod 555 and then, inside that, create a home for the website (or websites), with chmod 755 or the one you need: everything will work and the user will have write permissions. –  lucaferrario Nov 10 at 9:59

I needed to add the following to the /etc/vsftpd.conf file as well:

seccomp_sandbox=NO

AND no need for the custom repo!!

And uncomment the line:

write_enable=YES
share|improve this answer

The simple fix is to do as the error message suggests: make the root non-writable and then if you need to enable uploads, make a subdirectory which does have write permission. No config changes necessary.

share|improve this answer

For VSFTPD 3,

  1. Go to: /etc/vsftpd.conf
  2. and add this:

    allow_writeable_chroot=YES
    

And it should work.

share|improve this answer
1  
The questioner actually states that he already tried this and it did not work, so this is not an answer to his question. –  Requist Dec 15 at 18:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.